EclipseVULNRICHMENT:CVE-2024-8642CVE-2024-8642 Eclipse EDC: Consumer pull transfer token validation checks not applied
CVSS4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/SC:H/VI:N/SI:H/VA:N/SA:N/U:Green/RE:L
AI Score
Confidence
Low
EPSS
Percentile
27.5%
SSVC
Exploitation
poc
Automatable
no
Technical Impact
partial
In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity (expiry, not-before, issuance date), which can allow an attacker to bypass the check for token expiration. The issue requires to have a dataplane configured to support http proxy consumer pull AND include the module “transfer-data-plane”. The affected code was marked deprecated from the version 0.6.0 in favour of Dataplane Signaling. In 0.9.0 the vulnerable code has been removed.
ADP Affected
[
{
"cpes": [
"cpe:2.3:a:eclipse_foundation:edc:0.5.0:*:*:*:*:*:*:*"
],
"vendor": "eclipse_foundation",
"product": "edc",
"versions": [
{
"status": "affected",
"version": "0.5.0",
"lessThan": "0.9.0",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]Related
CVSS4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/SC:H/VI:N/SI:H/VA:N/SA:N/U:Green/RE:L
AI Score
Confidence
Low
EPSS
Percentile
27.5%
SSVC
Exploitation
poc
Automatable
no
Technical Impact
partial